<aside>
Privacy Policy Effective Date: October 30, 2026
</aside>
In accordance with Article 30 of the Personal Information Protection Act, acrossB (hereinafter referred to as the "Company") establishes and discloses this Privacy Policy to protect the personal information of data subjects and to address related complaints promptly and effectively.
This Privacy Policy covers the following matters.
The Company processes personal information to the extent necessary for the following purposes.
| Category | Purpose of Processing | Personal Information Processed | Collection Method | Legal Basis |
|---|---|---|---|---|
| Service Inquiries | Consultations regarding service adoption and responses to inquiries | Name, organization, email address, telephone number, and inquiry details | Entered directly by the person making the inquiry | Consent of the data subject (Article 15(1)(1) of the Personal Information Protection Act) |
| Customer Account Management | Identity verification, management of access permissions, service notifications and handling of complaints, and contacting designated personnel as needed for settlement and outstanding tasks following contract termination | Name, organization, email address, contact details, account identifier, password verification value, and permission information | User or customer company | Performance of a service contract with the customer company and legitimate interests in user management (Article 15(1)(4) and (6) of the Personal Information Protection Act) |
| Order and Logistics Services | Order fulfillment, warehouse receipt and dispatch, shipping, customs clearance, and responses to delivery-related inquiries | Buyer and recipient names, email addresses, telephone numbers, shipping addresses, purchased product names and quantities, order numbers, tracking numbers, and order notes | Customer companies and the sales channels they use | Performance of processing tasks entrusted by customer companies (Article 26 of the Personal Information Protection Act) |
| Service Usage and Security Management | Technical support, review of usage history, service quality analysis, incident response, and prevention of unauthorized access and misuse | IP address, access date and time, account identifier, service usage history, access logs, cookies, browser and device information, and details of actions performed | Generated during service use | Performance of the service contract and statutory security safeguard obligations (Articles 15(1)(2) and (4), and 29 of the Personal Information Protection Act) |
| Sanctions and Export Control Compliance | Screening against sanctions lists to comply with import/export and sanctions-related laws and regulations | Recipient name, shipping address and country, and order number | Information processed in the course of order and logistics services | Performance of entrusted shipping and customs clearance tasks and legitimate interests in complying with import/export-related laws and regulations (Articles 26 and 15(1)(6) of the Personal Information Protection Act) |
| Recruitment Applications | Conducting the recruitment process, pre-employment background checks, contacting applicants, and notifying applicants of results | Name, email address, telephone number, educational background, work experience, information contained in application documents, and background-check results (identity verification, verification of education and employment history, and, to the extent consented to by the applicant, confirmation of employment and employment periods with previous employers) | Submitted directly by the applicant. Previous employment is verified with the relevant former employer only where the applicant has provided written consent. | Steps taken at the applicant's request in connection with entering into an employment contract (Article 15(1)(4) of the Personal Information Protection Act). Background checks and talent-pool registration are subject to the applicant's separate consent (Article 15(1)(1) of the same Act). |
| Restricted Area Access Management | Controlling and recording access to restricted areas, including server rooms | Visitor name, organization, date and time of access, and purpose of visit | Recorded directly by the visitor | Statutory security safeguard obligations and legitimate interests in facility security (Articles 15(1)(2) and (6), and 29 of the Personal Information Protection Act) |
| Exercise of Rights and Complaint Handling | Receiving and processing access requests and other rights requests and complaints, and managing consent records | Requestor name, contact details, request details, identity verification results, and processing outcome | Submitted directly by the data subject or their representative | Compliance with statutory obligations (Articles 15(1)(2) and 34 through 38 of the Personal Information Protection Act) |
① The Company processes and retains personal information for the retention periods prescribed by applicable laws or agreed to by the data subject.
② Retention periods by processing purpose are as follows.
| Category | Retention Period |
|---|---|
| Service Inquiries | One year from the date the inquiry is received |
| Recruitment Application Documents and Background-Check Materials | 90 days from the date the hiring decision is finalized |
| Talent-Pool Registration Information | One year from the date of consent (where separate consent has been obtained). Deleted without undue delay upon withdrawal of consent. |
| Customer Account Information | Deleted within 30 days after account withdrawal or termination of the customer company's contract. However, account access permissions are revoked upon withdrawal or contract termination, and personal information no longer needed once its processing purpose has been fulfilled is destroyed without undue delay. The minimum contact details of designated personnel needed for settlement and outstanding shipping tasks following contract termination are retained until those tasks are completed and destroyed within five days thereafter. Hash values of account identifiers and withdrawal dates used to prevent misuse are stored separately for one year from the date of account withdrawal. |
| Buyer and Recipient Information Included in Orders and Shipments | Deleted within 30 days after delivery is completed |
| Information Needed for Ongoing Customer Service Cases (name, contact details, shipping information, and consultation history) | Deleted within 30 days after the customer service case is closed (and the outcome has been communicated) |
| Recipient Information in Carrier Integration Logs | 30 days from the date the record is created |
| Access Logs of Personal Information Processing Systems | Two years from the date the record is created |
| Personal Information Access and Download Logs | Three years from the date the record is created |
| System Audit and Security Logs | 12 months from the date the record is created. Logs needed to investigate a security incident are retained for five years after the incident is closed. |
| Operations and Incident Response Logs | 90 days from the date the record is created |
| Sanctions Screening Records | Five years from the screening date. For transactions subject to U.S. sanctions regulations, ten years from the transaction date. Names and addresses of recipients who do not match a sanctions target are deleted 30 days after delivery is completed. |
| Restricted Area Access Records | One year from the date the record is made |
| Rights Request Processing and Consent Records | Three years from completion of processing or termination of processing of the relevant personal information. Copies of identity documents used for verification are destroyed immediately upon completion of processing. |
③ The following information is retained separately from the periods listed above, as required by law.
| Records Subject to Statutory Retention | Items Retained | Retention Period and Legal Basis |
|---|---|---|
| Customer Company Records of Contracts, Withdrawal of Offers, Payments, and Supply of Goods | Order number, tracking number, transaction date and time, transaction amount, purchased product names and quantities, and details of contracts and withdrawals of offers | Five years; Article 6 of the Act on the Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree |
| Records of Consumer Complaints and Dispute Resolution Entrusted to the Company for the Customer Company's Statutory Retention Obligations | Complainant name, contact details, inquiry details, and processing outcome | Three years; Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce |
| Customs Declaration Supporting Documents Retained Under Statutory Obligations | Items included in the relevant declaration documents and legally required to be retained, among recipient name, address, contact details, purchased product names and quantities, order number, and tracking number | Imports: five years; exports and returns: three years; inward and outward movement of bonded cargo: two years. Article 12 of the Customs Act and Article 3 of its Enforcement Decree. |
The Company does not disclose personal information to third parties unless the data subject has consented or there is a legal basis for the disclosure. Details of third-party disclosures are as follows.
| Recipient | Purpose of Disclosure | Information Disclosed | Retention and Use Period | Legal Basis for Disclosure |
|---|---|---|---|---|
| Customs authorities of importing and exporting countries (Korea Customs Service and customs authorities of destination countries) | Import/export declarations and customs clearance | Recipient name, address, contact details, product name, quantity, price, order number, and tracking number | In accordance with the customs laws of the relevant country | Article 241 of the Customs Act and customs laws of the destination country (Articles 15(1)(2) and 17(1)(2) of the Personal Information Protection Act) |
| Investigative agencies, courts, and similar authorities | Conducting investigations, judicial proceedings, and inquiries pursuant to applicable law | Personal information within the scope of a request made pursuant to applicable law | The period prescribed by the applicable law | Article 18(2)(2) and (7) of the Personal Information Protection Act |
The Company entrusts personal information processing tasks as described below. Warehouses and carriers are selected for each customer company in consultation with that customer, and order information is shared only with the warehouse and carrier handling the relevant order.
① Processing tasks directly entrusted by the Company